The report
An MCP tool can be presented to an agent as a narrow helper while its implementation uses broader host authority. Three recent disclosures illustrate the gap: a repository name that reached a shell, a screenshot pathname validated before its final form, and a database metadata query that could interpret unexpected SQL statements.
The name advertised to the model is not the enforcement boundary
In AI-SDLC, GitHub issue and pull-request helpers constructed commands using a repository parameter and execSync. If the caller controlled that parameter, shell metacharacters could affect execution under the MCP host account. The source patch changes process invocation to use argument vectors; the first fixed published package was not confirmed in the evidence reviewed here.
In Chrome DevTools MCP, an output pathname was checked against a workspace root, but extension handling and a symlink could cause the final write to resolve elsewhere. This concerns local file writes, not an automatically demonstrated read of all files. The relevant property is the resolved output file descriptor, not the earlier string that passed validation. See the advisory.
In Tabularis, a nominally descriptive SQLite schema tool could incorporate an untrusted table name into query text. The reported driver behavior could permit stacked statements even when a separately named write tool was not approved. The advisory does not establish exploitation of a deployed Rust binary at a customer.
Testing the final effect
Each fix belongs at a different boundary: argument-vector process execution, canonical final-path containment, and validated SQL identifiers with a read-only database connection. A model-level instruction asking the agent to use only safe tools cannot repair any of those host-side mistakes.
The common acceptance test is simple in principle: after the tool completes, inspect what command ran, which file was actually written or what database statement executed. A safe-looking tool result or an unsuccessful final response is not sufficient proof that no unauthorized effect occurred.